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Description 

CENTRAL ENCRYPTION MANAGEMENT 

SYSTEM 

CROSS REFERENCE TO RELATED APPLICATIONS 

[0001] This Application is a Continuation of International Appli- 
cation PCT/JP03/05266 filed on April 24, 2003. Interna- 
tional Application PCT/JP03/05266 claims priority to 

Japanese Application 2002-134681 filed on May 9, 2002. 
FIELD OF THE INVENTION 

[0002] The present invention relates to a central encryption man- 
agement system. In particular, this invention relates to a 
system for encrypting/decrypting information to reduce 
risks of interception of information, change of information 
and the like that might be caused by attacks on networks 

from the outside. 
BACKGROUND OF THE INVENTION 



[0003] when a PC (personal computer) is used as a stand-alone 
system, there are small risks of interception, change, and 



destruction of information on the PC. However, on a net- 
work system like the Internet, information to be transmit- 
ted is routed through a number of networks. Therefore, 
once the PC is connected to such a network system, the 
risks of interception, change and the like can be largely 
increased during information communications. 

[0004] one of systems for solving the above-mentioned problem 
is an information encryption system. In this system, infor- 
mation to be transmitted is first encrypted at a transmis- 
sion PC, and then the transmission PC transmits the en- 
crypted data to a destination PC. The destination PC re- 
ceives and decrypts the encrypted data to use it appropri- 
ately. According to the system, since information to be 
transmitted is encrypted in advance, the risk of disclosure 
of information can be reduced even when the information 
is intercepted in the course of traveling on the network 
toward the destination PC. Further, by the encryption, the 
risk of change of the information can also be reduced. 

[0005] However, to use the encryption, it is necessary to install 
dedicated encryption software on all terminals for en- 
crypted data communications, and perform various set- 
tings. For example, various information can refer to: the 
presence/absence of the encrypting process, that is, the 



encrypted data communications can be performed be- 
tween a terminal and another terminal, but cannot be per- 
formed between other terminals; the encryption level 
when encrypted data communications are performed; the 
time period of the encryption; the encryption key, etc. The 
large amount of such information is to be set for each ter- 
minal. As a result, the users have to perform laborious 
operations to generate the system for use of the encryp- 
tion. 

[0006] The present invention has been developed to solve the 
above-mentioned problems, and aims at easily setting 
various information on each terminal to use the encryp- 
tion. 

SUMMARY OF THE INVENTION 

[0007] | n order to achieve the above object, the present invention 
is directed to a central encryption management system, 
comprising: a plurality of communications terminals for 
performing data communications; an encryption appara- 
tus which can be connected between the plurality of com- 
munications terminals; the apparatus including encryp- 
tion/decryption means for performing an encrypting pro- 
cess and a decrypting process on data to terminate en- 
cryption-based security between the encryption apparatus 



and the communications terminal having the encrypting 
capability; and a manager terminal for inputting various 
information for controlling encrypted-data communica- 
tions into each of the encryption apparatus and the com- 
munications terminals remotely from the manager termi- 
nal over a network, so that settings for the encrypted data 
communications on each of the apparatus and the termi- 
nals are completed, wherein the plurality of communica- 
tions terminals, the manager terminal, and the encryption 
apparatus are connected via a cable or wireless network. 

[0008] | n another aspect of the present invention, the encryp- 
tion/decryption means performs the encrypting process 
and the decrypting process on data, so that the encryption 
apparatus receives and retransmits data in the form of 
encrypted data from and to the communications terminal 
having the encrypting capability, and the encryption ap- 
paratus receives and retransmits the data in the form of 
non-encrypted data from and to the communications ter- 
minal having no encrypting capability. 

[0009] | n another aspect of the present invention, the encryption 
apparatus further includes bridge means for allowing 
data, which has been received with one of the plurality of 
ports of the encryption apparatus and then on which the 



encrypting or decrypting process has been performed, to 
be outputted as it is from another port without being per- 
formed any routing process. 
[0010] Further, in order to achieve the above objects, the present 
invention is also directed to a central encryption manage- 
ment system, comprising: a plurality of communications 
terminals for performing data communications; an en- 
cryption apparatus having a plurality of ports which can 
be connected between the plurality of communications 
terminals, in which the encryption apparatus performs en- 
crypting or decrypting process on data which has been re- 
ceived with one of the plurality of ports and then which 
has passed through a data link layer and a physical layer, 
and the encryption apparatus outputs the encrypted or 
decrypted data from another port through a data link layer 
and a physical layer without passing said data to a net- 
work layer in which routing between networks is con- 
trolled; and a manager terminal for inputting various in- 
formation for controlling encrypted-data communications 
into each of the encryption apparatus and the communi- 
cations terminals remotely from the manager terminal 
over a network, so that a setting of each of the apparatus 
and terminals for communicating encrypted data is com- 



pleted, wherein the plurality of communications terminals, 
the encryption apparatus, and the manager terminal are 
connected via a cable or wireless network. 
[001 1] | n another aspect of the present invention, the encryption 
apparatus further includes setting information storage 
means for storing the information inputted from the man- 
ager terminal, in which the inputted information is used 
when controlling the encrypting process and the decrypt- 
ing process, and the encryption apparatus controls the 
encrypting process and the decrypting process by com- 
paring the information stored in the setting information 
storage means with header information of a data packet 

of the data received with one of the plurality of ports. 
BRIEF DESCRIPTION OF THE DRAWINGS 

[0012] FIG. 1 shows an example of a central encryption manage- 
ment system according to the present invention; 

[0013] FIG. 2 shows another example of the central encryption 
management system according to the present invention; 

[0014] FIG. 3 shows another example of the central encryption 
management system according to the present invention; 

[0015] FIG. 4 shows another example of the central encryption 
management system according to the present invention; 

[0016] FIG. 5 shows hierarchical structures for protocols on the 



encryption apparatus according to the present invention, a 
DB server and a personal computer both of which are con- 
nected to the encryption apparatus; 

[0017] FIG. 6 shows a data structure of a data packet traveling on 
a network that uses the present invention, which is re- 
ferred to in describing IP addresses therein; 

[0018] FIG. 7 shows a data structure of a data packet traveling on 
an encryption apparatus used in this invention, which is 
referred to in describing MAC addresses therein; and 

[0019] FIG. 8 shows a data structure of a data packet traveling on 
a conventional VPN router, which is referred to in describ- 
ing MAC addresses therein. 
PREFERRED EMBODIMENTS OF THE INVENTION 

[0020] An embodiment according to the present invention will be 
described below by referring to the attached drawings. 

[0021] FIG. 1 shows an example of the entire configuration of a 
central encryption management system of this embodi- 
ment. 

[0022] | n fig. 1, each of encryption apparatuses 1 has two ports. 
To one of the ports, a terminal (device) such as a network 
printer 2, a DB server 3 and a network terminal 4 is con- 
nected. To the other port, a hub 5 is connected. Each of 
the encryption apparatuses 1 is provided between the hub 



5 and the terminal (i.e., the network printer 2, the DB 
server 3, or the network terminal 4), and relays data that 
is to be communicated therebetween. 

[0023] The network printer 2 is a terminal onto which an encryp- 
tion program (encryption software program) cannot be in- 
stalled for the physical reasons such as its structure, de- 
sign and the like. The DB server 3 is a terminal onto which 
the encryption program can be installed, but it is not pre- 
fer to install such a program thereon in view of stable op- 
erations and the like. The network terminal 4 is a terminal 
which is provided with no operating system, and thus it is 
impossible to operate the encryption program on the ter- 
minal. Therefore, the following description will be given 
on the assumption that no encryption program is provided 
onto these terminals 2-4. 

[0024] The hub 5 is a device for relaying data in the physical 
layer of the OSI reference model. In addition to the en- 
cryption apparatus 1, an access point 6 for wireless com- 
munications, a desktop PC (personal computer) 7 and a 
manager terminal 12 for setting various information for 
the encryption/decryption are connected to the hub 5. 
According to the configuration described above, the hub 5 
in this example relays data among the encryption appara- 



tus 1, the access point 6 and the desktop PC 7, so that 
encrypted data communications are performed. Further, 
when the manager terminal 12 sets various information 
onto each of the encryption apparatus 1, the access point 
6 and the desktop PC 7, the hub 5 also relays such infor- 
mation. 

[0025] By wireless, a desktop PC 8 and a laptop PC 9 are con- 
nected to the access point 6. The above-mentioned PCs 7 
- 9 are designed as to be able to store and operate an en- 
cryption program for encrypting/decrypting data, so that 
the encryption program can be installed thereon. In the 
following, the description will be given on the assumption 
that an agent software program for the encryption/de- 
cryption has already been installed onto the PCs 7 - 9 as 
well as the encryption apparatus 1. 

[0026] As described above, each encryption apparatus 1 of this 
embodiment has two ports, and to one of the ports the 
PCs 7-9 having an encrypting capability are indirectly 
connected via the hub 5 (and the access point 6 in the 
case of the PCs 8 and 9). Further, to the other of ports, 
the terminal (i.e., the network printer 2, the DB server 3, 
or the network terminal 4) is directly connected. In this 
embodiment, the encryption apparatus 1, the network 



printer 2, the DB server 3, the network terminal 4, the hub 
5, the access point 6 and the PCs 7-9 constitute a LAN 
(local area network). 

[0027] | n t he LAN having a structure described above, data com- 
munications are made between: 

[0028] (j)The terminals onto which NO encryption program is in- 
stalled (i.e., the network printer 2, the DB server 3 and the 
network terminal 4); and 

[0029] (jj)The terminals onto which the encryption program has 
been installed (i.e., the PCs 7 - 9), via the encryption ap- 
paratus 1, the hub 5 and the access point 6. (In this con- 
nection, it should be noted that each of the terminals 2 - 
4 and 7-9 corresponds to a terminal of the claimed in- 
vention.) 

[0030] when performing data communications within the LAN in 
FIG. 1, each encryption apparatus 1 receives/retransmits 
data in the form of encrypted data from/to the PCs 7-9 
having the encryption program. In addition, each encryp- 
tion apparatus 1 performs the encrypting process and the 
decrypting process on data during the data communica- 
tions, so that the encryption apparatuses 1 receives/ 
retransmits data in the form of non-encrypted data from/ 
to their respective terminals 2-4 having NO encryption 



program. 

[0031] For example, when data is to be transmitted from the 
desktop PC 7 to the network printer 2 to print out the 
data, the data is first encrypted on the desktop PC 7 using 
the installed encryption program. Then, the desktop PC 7 
sends the encrypted data to the encryption apparatus 1 
via the hub 5. The encryption apparatus 1 receives and 
decrypts the encrypted data, and then retransmits (relays) 
the decrypted data to the network printer 2. 

[0032] Further, when the data managed by the DB server 3 is to 
be downloaded from the laptop PC 9, the laptop PC 9 first 
sends a data transmission request to the DB server 3. In 
response to the request from the laptop PC 9, the DB 
server 3 sends the requested data in the form of NON- 
encrypted data to the encryption apparatus 1. The en- 
cryption apparatus 1 receives the non-encrypted data, 
and then encrypts the received data. Then, the encryption 
apparatus 1 retransmits the encrypted data to the laptop 
PC 9 via the hub 5 and the access point 6. Finally, the lap- 
top PC 9 receives and decrypts the encrypted data, so that 
the requested data can be processed appropriately for a 
desired purpose on the laptop PC 9. 

[0033] As described above in detail, the encryption apparatus 1 



of this embodiment can be applied to a LAN (in particular, 
an in-house LAN) including terminals such as the termi- 
nals 2-4 where installation of a dedicated encryption 
program is impossible. Thus, when the encryption appa- 
ratus 1 is used in such a LAN, it becomes possible to per- 
form encrypted-data communications even within the 
above-mentioned LAN including the terminals 2-4 where 
installation of a dedicated encryption program is impossi- 
ble. Therefore, use of the encryption apparatus 1 of this 
invention makes it possible to realize a secure network 
10, where risks of interception and change of confidential 
information inside the LAN are small, even when someone 
who unauthorized enters and attacks the network from 
the outside. 

[0034] | n t his connection, it should be noted that although the 
encryption cannot be used between the encryption appa- 
ratuses 1 and their respective terminals 2 - 4, no security 
problems occur therebetween. This is because cables 11 
connecting the encryption apparatuses 1 to the terminals 
2 - 4 are physically short, and therefore there is smallest 
possibility that data is intercepted and changed by the at- 
tack from these short cables 11. 

[0035] | n the above-mentioned encryption system, various infor- 



mation can be set onto the encryption agent software 
program installed on the encryption apparatus 1 and each 
of the PCs 7-9. The setting of such information can be 
performed by sending (downloading) the information from 
a manager terminal 12 to each of the encryption appara- 
tus 1 and the PCs 7 - 9 via the hub 5. Examples of the in- 
formation to be set include: 

[0036] (A)lnformation that instructs to perform the encrypting/ 
decrypting process, or instructs not to perform the en- 
crypting/decrypting process; 

[0037] (B)lnformation for instructing to discard data packets (In 
particular, this information instructs to discard data pack- 
ets, when data packets to be communicated between pre- 
determined terminals have been received.); 

[0038] (C)lnformation for instructing a security level of the en- 
cryption; 

[0039] (D)lnformation for instructing time when data encryption 

is to be performed; 
[0040] (e) The encryption policy for each division; and 

[0041] (F)lnformation for encryption keys. 

[0042] | n this way, it is NOT necessary to set various information 
required for encrypted-data communications onto all ter- 



minals, INDIVIDUALLY. That is, the manager terminal 12 
can centrally manage the entire encryption system. There- 
fore, various information can be easily set onto each ter- 
minal, and the laborious operations required to produce 
and maintain the encryption system can be remarkably re- 
duced. 

[0043] Generally, a conventional in-house LAN includes: 

[0044] (A)Terminals (e.g., a printer, a facsimile and the like) 

where installation of an encryption program is impossible 
for physical reasons; 

[0045] (B)Terminals (e.g., a print server, a database server, and 

the like) where excessive installation of software programs 
is not preferred; and 

[0046] (QTerminals that function simply as network terminals 
and that have no operating system. 

[0047] Therefore, it has generally been very difficult to use en- 
cryption in such an in-house LAN. 

[0048] Thus, the conventional encryption system encrypts the in- 
formation communicated between the terminals con- 
nected to the Internet on the way through the Internet. In 
this case, since there are a number of terminals involved 
in the encrypted data communications in the Internet, it 
has been very difficult to centrally manage the encryption 



for the large number of terminals. On the other hand, ac- 
cording to the present embodiment, the encryption can be 
used in an in-house LAN. Therefore, the encryption termi- 
nated in the LAN can be centrally managed. 

[0049] FIG. 2 shows another example of the central encryption 

management system of this embodiment. In FIG. 2, an ap- 
paratus having the same function as that shown in FIG. 1 
is assigned the same reference numeral. As shown in FIG. 
2, the encryption apparatus 1 of this example is con- 
nected to Internet 20 via one of the ports thereof, and is 
also connected to the hub 5 via the other port. 

[0050] | n the example shown in FIG. 2, the encryption apparatus 
1, the hub 5, the access point 6 and the PCs 7-9 config- 
ure a LAN connected to the Internet 20. At the outside of 
the LAN, another plurality of terminals (not shown) are 
also connected to the Internet 20. Of course, such a plu- 
rality of terminals connected to the Internet 20 at the out- 
side of the LAN include terminals where installation of an 
encryption program is impossible (i.e., terminals like the 
network printer 2, the DB server 3 and the network termi- 
nal 4); and/or terminals where an encryption program has 
been installed (i.e., terminals like the PCs 7 - 9). These 
terminals configure another LAN different from the secure 



network (LAN) 10. 
[0051] | n the example shown in FIG. 1, the terminal is connected 
to the encryption apparatus 1, one by one, and the en- 
crypting/decrypting process for one terminal is performed 
dedicatedly by one encryption apparatus 1. That is, the 
encryption apparatus 1 shown in FIG. 1 is connected be- 
tween the terminal having no encryption program and a 
group of the PCs 7-9 where the encryption program has 
been installed. In this system, the encryption apparatus 1 
terminates the encryption-based security (i.e., the security 
which utilizes encryption technology) with respect to the 
one terminal. 

[0052] on contrast with this, in the example shown in FIG. 2, the 
encryption apparatus 1 is provided between a group of 
the plurality of terminals (not shown) outside the secure 
network 10 and a group of the PCs 7-9 onto which the 
encryption program has been installed. (The outside ter- 
minals are connected to the secure network 10 via the In- 
ternet 20.) The above-mentioned plurality of terminals 
outside the secure network 10 may be provided with NO 
encryption program in the same manner as the network 
printer 2, the DB server 3 and the network terminal 4 
shown in FIG. 1. Alternatively, these terminals may also be 



provided with an encryption program in the same manner 
as the PCs 7-9. Accordingly, the single encryption appa- 
ratus 1 of this example is designed so as to be able to 
terminate the encryption-based security with respect to a 
plurality of terminals. In this case, the encryption appara- 
tus 1 has to have data paths for the respective connected 
terminals, and performs the encrypting/decrypting pro- 
cess using different encryption keys for the respective 
terminals. 

[0053] For example, when data is to be transmitted via the Inter- 
net 20 from the desktop PC 7 inside the secure network 
10 to an outside terminal (which is connected to the Inter- 
net 20 at the outside of the secure network 10) having NO 
encryption program, the data is first encrypted on the 
desktop PC 7 using the installed encryption program. 
Then, the desktop PC 7 sends the encrypted data to the 
encryption apparatus 1 via the hub 5. The encryption ap- 
paratus 1 receives the encrypted data and decrypts the 
received encrypted data, and then retransmits (relays) the 
decrypted data to the outside terminal via the Internet 20. 

[0054] Further, for example, when data managed by an outside 
terminal having NO encryption program is to be down- 
loaded from the laptop PC 9 inside the secure network 10, 



the laptop PC 9 first sends a data transmission request to 
the outside terminal. In response to the request, the out- 
side terminal transmits the requested data in the form of 
non-encrypted data via the Internet 20. Then, the encryp- 
tion apparatus 1 receives and encrypts the requested 
data, and then retransmits (relays) the requested data in 
the form of encrypted data to the laptop PC 9 via the hub 
5 and the access point 6. Finally, the laptop PC 9 receives 
and decrypts the encrypted data, so that the requested 
data can be processed appropriately for a desired purpose 
on the laptop PC 9. 
[0055] Furthermore, when data is to be transmitted from the 

desktop PC 7 inside the secure network 10 to an outside 
terminal having an encryption program, the data is first 
encrypted on the desktop PC 7 using the installed encryp- 
tion program. Then, the desktop PC 7 sends the encrypted 
data to the encryption apparatus 1 via the hub 5. As soon 
as the encryption apparatus 1 receives the encrypted data, 
it retransmits (relays) the received data without any de- 
cryption to the outside terminal via the Internet 20. Fi- 
nally, the outside terminal decrypts the received data, so 
that the requested data can be processed appropriately 
for a desired purpose on the outside terminal. 



[0056] Conversely, when encrypted data on the outside terminal 
outside of the secure network 10 is to be transmitted via 
the Internet 20 to the desktop PC 7 inside the secure net- 
work 10, similarly the encryption apparatus 1 relays the 
data in the form of encrypted data to the desktop PC 7 via 
the hub 5, without decrypting the data received from the 
outside terminal via the Internet 20. 

[0057] Thus, even in the case where data communications are 

performed between any of the PCs 7-9 inside the secure 
network 10 and the outside terminal (which is connected 
to the Internet 20 at the outside of the secure network 10) 
with NO encryption program, the encryption-based secu- 
rity at least inside the secure network 10 can be main- 
tained. Of course, when the outside terminal has an en- 
cryption program, the encryption can be utilized in data 
communications not only inside the secure network 10, 
but also on the Internet 20 outside the secure network 10. 

[0058] n 0Wj j n the examples described above, the plurality of 
terminals are connected to the secure network 10 via the 
Internet 20, but a manner of the connection is not limited 
to these examples. For example, the plurality of terminals 
may be connected directly to the encryption apparatus 1 
or connected via a hub. In this connection, when connect- 



ing directly, the encryption apparatus 1 has to have at 
least two ports. 

[0059] FIG. 3 shows another example of the central encryption 
management system of this embodiment. In FIG. 3, a ter- 
minal having the same function as that shown in FIG. 1 is 
assigned the same reference numeral. Similar to the ex- 
ample shown in FIG. 2, the example in FIG. 3 is also di- 
rected to a case of the encryption apparatus 1 terminating 
the encryption-based security with respect to a plurality 
of terminals. 

[0060] | n the example shown in FIG. 3, inside the secure network 
10 the PCs 7 - 9 are all connected to the access point 6 
by wireless. The access point 6 is connected to the In- 
ternet 20 via the encryption apparatus 1. Further, the se- 
cure network 10 includes another access point 6 in ad- 
dition to the access point 6 . This access point 6 covers 
a communications range where the access point 6 can- 
not transmit/receive data to/from the PCs 7 - 9, so that 
relatively large wireless LAN environment is provided. The 
access points 6 and 6 are connected to their respec- 
tive encrypted apparatuses 1. 

[0061] | n the encryption system with the above-mentioned con- 
figuration, for example, when the laptop PC 9 wirelessly 



connected to the access point 6 moves beyond the com- 
municable range for the access point 6 , the roaming op- 
eration is performed to switch the relay operation from 
the access point 6 to the other access point 6 . Further, 
as described above, since the manager terminal 12 cen- 
trally manages the settings of the paths for the encrypted 
data communications, the encrypted data communications 
can be continued even when the roaming operation is 
performed among a plurality of access points. 
[0062] Further, in the example shown in FIG. 3, the manager ter- 
minal 12 is connected to the Internet 20. Therefore, when 
the manager terminal 12 of this example sets various in- 
formation onto the encryption agent software, the data is 
downloaded from the manager terminal 20 to each of the 
encryption apparatuses 1 and the PCs 7 - 9 via the Inter- 
net 20. 

[0063] FIGS. 2 to 4 show examples in which, there are one secure 
network 10 and one manager terminal 12 for centrally 
managing the encryption in the network. It is further pos- 
sible to include a plurality of secure networks 10 and a 
plurality of manager terminals 12 for centrally managing 
the respective encryption, and to allow each manager ter- 
minal 12 to appropriately set various information relating 



to the encryption/decryption during the data communica- 
tions through the Internet 20, etc., thereby generating the 
entire encryption system for the plurality of secure net- 
works 10 collectively. 

[0064] | n t he above, with referring to FIGS. 1-3, the PCs 7 - 9 
having the encryption program were described as exam- 
ples of a terminal having an encrypting capability. Further, 
the termination of the security between the encryption 
apparatus(es) 1 and a group of the PCs 7-9 was de- 
scribed as an example of the termination using a terminal 
with an encrypting capability. However, a terminal with 
encrypting capability which can be used in this invention 
is not limited to these examples. Namely, examples of 
such a terminal include other encryption apparatuses hav- 
ing a capability similar to that of the encryption apparatus 
1. One of such examples is shown in FIG. 4. 

[0065] | n the example shown in FIG. 4, a LAN 30A at a local area 
A and a LAN 30B at a local area B are connected with 
routers 40A and 40B via the Internet 20. The LAN 30A at 
local area A is designed as an in-house LAN including PCs 
31A - 33A and encryption apparatuses 1A - 1A . In the 
LAN 30A, each of the PCs 31A - 33A corresponds to a ter- 
minal having NO encryption program. Further, each of the 



encryption apparatuses 1A - 1A has the same function 
as that of the encryption apparatus 1 shown in FIG. 1. To 
one of ports of each of the encryption apparatuses 1A - 
1A , the router 40A is connected. To the other ports of 
the encryption apparatuses 1A - 1A , the PCs 31A - 
33A are connected, respectively. 
[0066] Similarly, the LAN 30B at local area B is also designed as 
an in-house LAN including PCs 31B - 33B and encryption 
apparatuses IB - IB . In the LAN 30B, each of the PCs 
3 IB - 33B corresponds to a terminal having NO encryp- 
tion program. Further, each of the encryption apparatuses 
IB - IB has the same function as that of the encryp- 
tion apparatus 1 shown in FIG. 1. To one of ports of each 
of the encryption apparatuses IB - IB , the router 40B 
is connected. To the other ports of the encryption appara- 
tuses IB -IB , the PCs 31B - 33B are connected, re- 
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spectively. 

[0067] with the above-mentioned network structure, when data 
communications are preformed among the PCs belonging 
to the different LANs 30A and 30B, data is transmitted/re- 
ceived via the encryption apparatuses 1A - 1A and IB 

- IB . For example, when data is to be transmitted from 
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the PC 31A in the LAN 30A to the PC 33B in the LAN 30B, 



the PC 31A first sends the data to the encryption appara- 
tus 1A . The encryption apparatus 1A i receives and en- 
crypts the data, and then retransmits (relays) the en- 
crypted data to the encryption apparatus IB 3 via the 
router 40A, the Internet 20 and the router 40B. The en- 
cryption apparatus IB receives and decrypts the en- 
crypted data, and then further retransmits (relays) the de- 
crypted data to the PC 33B. In this way, data communica- 
tions utilizing the encryption can be achieved between the 
different LANs 30A and 30B. 

[0068] Further, in this example, when data communications are 
performed inside the LAN 30A (i.e., among the PCs 31A - 
33A having NO encryption program), data is transmitted/re- 
ceived via the encryption apparatuses 1A - 1A . For ex- 
ample, when data is to be transmitted from the PC 31A to 
the PC 33A, the PC 31A first sends the data to the encryp- 
tion apparatus 1A . The encryption apparatus 1A re- 
ceives and encrypts the data, and then retransmits (relays) 
the encrypted data to the encryption apparatus 1A . The 
encryption apparatus 1A decrypts the received en- 
crypted data, and then further retransmits (relays) the de- 
crypted data to the PC 3 3 A. 

[0069] Similarly, when data communications are performed inside 



the LAN 30B (i.e., among the PCs 31B - 33B having NO 
encryption program), data is transmitted/received via the 
encryption apparatuses IB - IB . For example, when 
data is to be transmitted from the PC 3 IB to the PC 33B, 
the PC 3 IB first sends the data to the encryption appara- 
tus IB . The encryption apparatus IB receives and en- 
crypts the data, and then retransmits (relays) the en- 
crypted data to the encryption apparatus IB . The en- 
cryption apparatus IB decrypts the received encrypted 
data, and then further retransmits (relays) the decrypted 
data to the PC 33B. 
[0070] As described above, in this example, the encryption appa- 
ratuses 1A - 1A and IB - IB receive/retransmit 
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data in the form of NON-encrypted data from/to their re- 
spective PCs 31A - 33A and 3 IB - 33B having NO encryp- 
tion program. On the other hand, the encryption appara- 
tuses 1A - 1A and IB - IB perform the encrypting 
process and the decrypting process, so that any one of 
the encryption apparatuses 1A - 1A and IB - IB 
receives/retransmits data in the form of encrypted data 
from/to one of the other encryption apparatuses. 
[0071] By connecting the above-mentioned encryption appara- 
tuses 1A - 1A and IB - IB closer (directly) to the 
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PCs 31A - 33A and 3 IB - 33B respectively, data commu- 
nications using the encryption can be realized not only 
between different LANs 30A and 30B, but also inside an 
in-house LAN which includes PCs with NO encryption pro- 
gram. This makes it possible to configure each of the 
LANs 30A and 30B as a secure network almost free of the 
risks of interception and change of confidential informa- 
tion by unauthorized entries or attacks form the outside. 

[0072] | n t he example shown in FIG. 5, a plurality of manager 

terminals 12A and 12B for centrally managing the encryp- 
tion in the base networks 30A and 30B respectively are 
connected to the Internet 20. Each of the manager termi- 
nals 12A and 12B communicates data with each other 
through the Internet 20, and appropriately sets various 
information relating to the encryption/decryption. Thus, 
one encryption system can be generated collectively for 
the plurality of base networks 30A and 30B. 

[0073] | n the example shown in FIG. 4, each of the LANs 30A and 
30B is provided with a plurality of terminals having the 
encrypting capability (i.e., the encryption apparatuses 1A 
- 1A and IB - IB ). However, this invention is not 
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limited to this example, and it may be formed by provid- 
ing at least one of the LANs 30A and 30B with only one 



terminal having the encrypting capability. For example, 
the LAN 30A may be formed from a single PC 31A and a 
single encryption apparatus 1A connected to the PC 
31 A. 

[0074] | n this example, similar to the example shown in FIG. 4, 

data communications using the encryption can also be re- 
alized between the different LANs 30A and 30B. Further, 
when the encryption apparatus 1A i is connected closer to 
the PC 31A, the encryption can also be used in data trans- 
mission between an enter/exit point of the LAN 30A and 
the encryption apparatus 1A inside the LAN 30A. 

[0075] | n the example shown in FIG. 4, two LANs 30A and 30B 

are connected via the Internet 20. Further, the LAN 30A is 
provided with the encryption apparatuses 1A - 1A and 
the PCs 31A - 33A, and the LAN 30B is provided with the 
encryption apparatuses IB - IB and the PCs 3 IB - 
33B. However, it should be noted that configuration of 
this invention is not limited to this example. 

[0076] For example, a single LAN may be provided with all of the 
encryption apparatuses 1A - 1A and IB - IB and 
the PCs 31A - 33A and 31B - 33B, so that data communi- 
cations can be achieved inside the LAN among the PCs 
31A - 33A and 3 IB - 33B having NO encryption program 



via the encryption apparatuses 1A - 1A and IB - IB 
. In this case, at least among the encryption apparatuses 
1A - 1A and IB - IB inside the single LAN, data 
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communications using the encryption can be realized. 

[0077] Further, for another example, a LAN may be designed so 
as to have the same arrangement as that shown in FIG. 1, 
except that the desktop PC 7 having the encryption pro- 
gram is changed to a set of a PC with no encryption pro- 
gram and the encryption apparatus 1 that is to be con- 
nected to the hub 5. In this example, encrypted-data 
communications can be achieved between the PC with no 
encryption program and one of the network printer 2, the 
DB server 3 and the network terminal 4, via their respec- 
tive encryption apparatuses 1 connected closer thereto. 

[0078] FIG. 5 shows the hierarchical structure of the protocols 
used for the encryption apparatus 1, the DB server 3 and 
the PC 9 connected to the encryption apparatus 1 (which 
are used in the encryption system shown in FIG. 1). In the 
example shown in FIG. 5, the laptop PC 9 is provided with 
the encryption program, and the DB server 3 is provided 
with NO encryption program. (This means that the laptop 
PC 9 has IP-Sec, and the DB server 3 has no IP-Sec.) The 
encryption apparatus 1 of this embodiment is provided 



between the DB server 3 and the laptop PC 9. The exam- 
ple in FIG. 5 shows a case where the DB server 3 sends 
data stored therein to the encryption apparatus 1, and 
then the encryption apparatus 1 encrypts the received 
data before retransmitting it to the PC 9. 

[0079] as shown in FIG. 5, the DB server 3 and the PC 9 have 

ports 31 and 32, respectively. Further, the encryption ap- 
paratus 1 in FIG. 5 is designed so as to function as a relay 
device with two ports 33 and 34. In the encryption appa- 
ratus 1, the physical layer and the MAC layer (data link 
layer) are provided for each of the ports 33 and 34. In ad- 
dition, for the ports 33 and 34, the IP-Sec 
(encrypting/decrypting capability), the IP layer (network 
layer) and the TCP/UDP layer (transport layer) are provided 
as common layers. 

[0080] | n this hierarchical structure of the protocol, the lower 

layer is farther from a user, and the higher layer is closer 
to the user. In each of the DB server 3 and the PC 9, the 
TCP/UDP layer and the application layer (not shown in the 
drawings) are above the IP layer, and they are used for 
communications between a user application and lower 
layers. 

[0081] when data is transmitted from a transmission end to a re- 



ception end, data is first converted on the transmission 
end, each time the data passes each layer from an upper 
layer to a lower layer. In addition, each time the data 
passes each layer, header information for enabling data 
exchange between the same level layers is added to the 
data. On the other hand, on the reception end, each layer 
refers to the header information addressed to its layer, 
and extracts necessary data. Then, the extracted data is 
passed to upper layers, and finally delivered to the user 
through the application layer. 
[0082] | n the following, functions of each of the layers will be de- 
scribed. The TCP/UDP layer is used in: determining an ap- 
plication to which data is passed; managing conditions of 
data packets; and achieving other operation. On the data 
transmission end, data is passed from the upper layer 
(application layer), and then it determines an application 
to which the data is passed at the reception end. After the 
determination, a destination port number is added to the 
data, and then the data is passed to the lower layer 
(network layer). On the other hand, on the data reception 
end, data packets passed from the lower layer are moni- 
tored to judge that whether or not there is a missing 
packet due to the communications condition and the like. 



[0083] The IP layer is used in managing and controlling data re- 
transmission (relay) performed between terminals over a 
plurality of networks. The DB server (transmission end) 3 
and the PC (reception end) 9 are assigned different IP ad- 
dresses <1> and <4>, respectively, to define their re- 
spective addresses. Thus, the end-to-end type of logical 
communications path is established. 

[0084] The MAC (media access control) layer is used in ensuring 
reliable data transmission between adjacent nodes 
(devices). To the MAC layer on each device, a physical 
MAC address is assigned when manufacturing the device. 
On the transmission end, an IP address of the reception 
end is read out in the IP layer. Then, based on the read 
out IP address of the reception end, the MAC layer deter- 
mines a next relaying point (i.e., one of adjacent nodes 
that are physically connected to the transmission end) to 
which the data is to be sent. In addition, it finds out an IP 
address of the next relaying point. On the other hand, on 
the reception end, it is judged based on the MAC address 
that whether or not the received data packet is addressed 
to its own end. When judged that it is addressed to the 
reception end, the IP address is further analyzed in the IP 
layer above the MAC layer. Then, according to the analysis 



result, it is determined that whether the data packet is to 
be further routed to another node, or to be stored therein. 

[0085] a physical layer is used in: converting data received from 
upper layers into a signal such as an electric signal and an 
optical signal; transmitting the data signal through a 
transmission line 111 such as a coaxial cable and an opti- 
cal fiber cable; converting the data signal transmitted 
through the transmission line 111 into the data recogniz- 
able by upper layers; and passing the data to upper layers. 
In the MAC layer above the physical layer, the above- 
mentioned process is performed in a manner depending 
on the communications interface of the physical layer. 

[0086] The IP-Sec has a function of performing an encrypting 
process and a decrypting process on data. According to 
the function, the encrypting/decrypting process is per- 
formed on data passed from the MAC layer. 

[0087] The encryption apparatus 1 of this embodiment is charac- 
terized in that the IP-Sec serves as a bridge which links 
the two ports 33 and 34. In this connection, the term 
"bridge" indicates a function of sending data just as it is 
(which has inputted therein via one of the ports and then 
on which the encrypting or decrypting process has been 
performed) to another port without performing any rout- 



ing process. In more detail, in the example shown in FIG. 
5 data is inputted via the first port 33, and then the de- 
crypting process is performed on the inputted data at the 
IP-Sec. Then, without performing on the encrypted data 
any routing process at the IP layer, the encrypted data 
(just as it is) is sent to and outputted from the second 
port 34. (In other words, without passing the encrypted 
data to the IP layer, the data after the decryption, just as it 
is, is sent to and outputted from the second port 34.) This 
manner corresponds to the above-mentioned "bridge" 
process. Namely, in the encryption apparatus 1 according 
to the present embodiment, the IP layer and the TCP/UDP 
layer are not used in the data transmission between the 
DB server 3 and the PC 9, and the data transmission pro- 
cess is carried out in layers lower than the IP layer. 
[0088] | n the example shown in FIG. 5, each data packet pro- 
duced on the DB server 3 is first outputted therefrom 
through the MAC layer and the physical layer. The data 
packet outputted from the DB server 3 is then received by 
the encryption apparatus 1 via the first port 33. In the en- 
cryption apparatus 1, the received data packet is passed 
to the IP-Sec through the physical layer and the MAC 
layer. In the IP-Sec, the encryption process is performed 



on a data part of the data packet. The encrypted data 
packet (i.e., the data packet including the encrypted data 
part) is sent to the second port 34 through the MAC layer 
and the physical layer, and then the encrypted data packet 
is outputted from the second port 34. 

[0089] The data packet outputted from the second port 34 of the 
encryption apparatus 1 is then received by the PC 9, and 
is passed to the IP-Sec through the physical layer and the 
MAC layer. In the IP-Sec at the PC 9, the encrypted data 
packet is decrypted, and then the decrypted data packet is 
passed to the application layer (not shown) through the IP 
layer. In this way, in spite of the fact that an encryption 
program is not installed on the DB server 3, data can be 
transmitted in the form of encrypted data to the PC 9. 

[0090] | n t his embodiment, the IP layer and the TCP/UDP layer on 
the encryption apparatus 1 are used when inputting vari- 
ous information for the encryption/decryption into the 
encryption apparatus 1 from the manager terminal 12 
mentioned above. The information inputted into the en- 
cryption apparatus 1 is stored in a memory with the 
bridge function of the IP-Sec. When controlling the en- 
crypting/decrypting process and other processes, the IP- 
Sec compares the information stored in the memory with 



header information (i.e., a source IP address and a desti- 
nation IP address) that is included in a data packet in- 
putted via the port 33 (34). 

[0091] As described above, in the IP-Sec, the encryption appara- 
tus 1 of this embodiment performs the encryption/de- 
cryption process on data that has been inputted via one of 
the ports. Further, the encryption apparatus 1 sends the 
encrypted/decrypted data just as it is to another port 
without passing this data to the IP layer (i.e., without per- 
forming any routing process). This makes it possible for 
the encryption apparatus 1 to operate with no IP address 
during data communications. This means that the encryp- 
tion apparatus 1 can perform the data encryption/decryp- 
tion during data communications, in spite of the fact that 
it has no IP address. Therefore, according to the present 
invention, the encryption apparatus 1 is free of the labori- 
ous setting operation for an IP address. 

[0092] Further, for the reasons described above, even when the 
encryption apparatus 1 is provided between adjacent ter- 
minals, these terminals still belong to the same network. 
This means that there is no need for the input and output 
ports of the encryption apparatus 1 to have different IP 
addresses. Therefore, the transparency of the IP address 



can be maintained regardless of the connection of the en- 
cryption apparatus 1 on the network. In other words, it is 
not necessary to set or change IP addresses of terminals 
connected to the encryption apparatus 1 when connect- 
ing/removing the encryption apparatus 1 to/from the net- 
work. 

[0093] For example, in the case where the communications are 
directly performed between the DB server 3 and the PC 9 
without connecting the encryption apparatus 1, the IP ad- 
dress of a data packet communicated between the DB 
server 3 and the PC 9 is as shown in FIG. 6. In this con- 
nection, it should be noted that, even in the case where 
the encryption apparatus 1 is connected between the DB 
server 3 and the PC 9 as shown in FIG. 5, the IP address of 
a data packet communicated between the DB server 3 and 
the PC 9 is unchanged (i.e., that is also as shown in FIG. 
6). Therefore, it is not necessary to change the address 
settings regardless of the connection of the encryption 
apparatus 1. 

[0094] Thus, when arranging or maintaining a network system, it 
is necessary only to connect/remove the encryption appa- 
ratus 1 of this embodiment to/from an appropriate point 
of the network system. In other words, it is needless to 



perform a laborious setting operation for an IP address. 
Therefore, the load of users is considerably reduced. 

[0095] Further, according to the present embodiment, the trans- 
parency for the MAC address can also be maintained. FIG. 
7 shows a data structure of a data packet in the case 
where the encrypted apparatus 1 performs the encryption 
on data that is to be transmitted to the PC 9 from the DB 
server 3. FIG. 7 A shows the data packet received with the 
first port 33, and FIG. 7B shows the data packet to be re- 
transmitted from the second port 34. In this connection, 
the IP-Sec operates in two modes of a transport mode and 
a tunnel mode. In the transport mode, the encryption is 
performed only on a data part of a data packet. On the 
other hand, in the tunnel mode, the encryption is per- 
formed on entire of a data packet, and then new header 
information is added to the encrypted data packet. In FIG. 
7B, the data packet to be transmitted from the second 
port 34 is shown in the two modes. 

[0096] This embodiment is compared with a data structure in 
FIG. 8. FIG. 8 shows a data structure of a data packet in 
the case where data is transmitted to one of PCs from the 
other PC inside a system using a conventional VPN router, 
and the VPN router between the PCs performs the encryp- 



tion on the data during the data transmission. FIG. 8A 
shows the data packet received with a first port of the VPN 
router, and FIG. 8B shows the data packet to be retrans- 
mitted from a second port of the VPN router. In the same 
manner as that shown in FIG. 7B, in FIG. 8B the data 
packet to be transmitted from the second port is also 
shown in the above-mentioned two modes. 

[0097] a s clearly shown in FIG. 7, according to the present em- 
bodiment, not only the IP addresses, but also the MAC ad- 
dresses are NOT different between the data packet re- 
ceived with the first port 33 and the data packet to be 
transmitted from the second port 34. This means that in 
the example shown in FIG. 7, transparency for the MAC 
address is maintained. That is, the encryption apparatus 1 
according to the present embodiment merely passes the 
data inputted from one port to another port except having 
the IP-Sec and performing the encrypting/decrypting pro- 
cess with the IP-Sec. Therefore, even when communicat- 
ing a data packet which has no MAC address, the en- 
crypted apparatus can relay the data packet. 

[0098] | n the above-mentioned embodiment, the IP layer is used 
as an example of a network layer which is the third layer 
of the OSI reference model. However, this invention is not 



limited to this example, and an IPX (Internetwork Packet 
exchange) layer which is a protocol used on the network 
OS produced by Novell, inc. may be used for the network 
layer, instead of the IP layer. Alternatively, any other pro- 
tocol may also be used, as long as it can cooperate with 
the IP-Sec. 

[0099] The above-mentioned embodiments of the present inven- 
tion are a few of examples of this invention, and the scope 
of invention is not limited to them. Therefore, various 
modifications and changes can be made without departing 
from the spirit and the scope of the invention. 

[0100] According to the present invention described above, the 
encryption apparatus includes encryption/decryption 
means for performing an encrypting/decrypting process 
on data to terminate encryption-based security between 
the encryption apparatus and a terminal having an en- 
crypting capability. Further, the manager terminal can be 
used in inputting various information for controlling en- 
crypted-data communications into each of the encryption 
apparatus and terminals remotely from the manager ter- 
minal, so that settings for the encrypted data communica- 
tions on each of the apparatus and the terminals are com- 
pleted. Furthermore, the encryption system is formed by 



connecting the encryption apparatus, the manager termi- 
nal and the terminals which are capable of encrypted data 
communications. This configuration makes it possible for 
an in-house LAN including terminals where installation of 
a dedicated encryption program is impossible to utilize 
the encryption. In addition, the termination of the encryp- 
tion inside the LAN can be centrally managed by the man- 
ager terminal. Thus, laborious operations required when 
arranging and maintaining the encryption system are con- 
siderably reduced. 
INDUSTRIAL UTILIZATION 

[0101] The present invention is preferably used in arranging a 
system which allows various information for encrypted 
data communications to be easily set onto each terminal. 



